mobile-capacitor-platform
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends using
npxto execute ecosystem-standard tools such as@capgo/capgo-secfor security scanning andskills addfor extending functionality. These operations are standard practices within the Capacitor development workflow for maintenance and auditing. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process project-specific files including
package.json,capacitor.config.ts, and native build files (.gradle,Podfile), creating a potential surface for indirect injection from project metadata. - Ingestion points:
package.json,capacitor.config.ts,ios/**,android/**,**/*.gradle,**/Podfile. - Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for the ingested file content.
- Capability inventory: Modifying native build files, running
npx cap sync, and invoking security CLI tools. - Sanitization: No explicit sanitization or filtering of input file content is described in the guidelines.
- [CREDENTIALS_UNSAFE]: The skill includes explicit warnings against committing sensitive mobile assets, such as
*.keystoreor*.p12files, to the repository and provides guidance on using secure CI secrets or Keychains instead, which is a key security best practice.
Audit Metadata